2018 (9) TMI 1733 - SC - Indian Laws

Aadhaar Card - right of Privacy - the main plank of challenge of petitioners is that the Aadhaar project and the Aadhaar Act infringes right to privacy - Held that - The architecture of Aadhaar as well as the provisions of the Aadhaar Act do not create a surveillance state. This is ensured by the manner in which the Aadhaar project operates. During the enrollment process minimal biometric data in the form of iris and fingerprints is collected. The Authority does not collect purpose location or details of transaction. Thus it is purpose blind. There are sufficient security measures as well - it is very difficult to create profile of a person simply on the basis of biometric and demographic information stored in CIDR. Aadhaar is thus held to be valid.

Summary

1. ISSUES PRESENTED and CONSIDERED

The core legal questions considered by the Court include:

- Whether the requirement under the Aadhaar Act to provide demographic and biometric information violates the fundamental right to privacy.

- Whether the provisions of the Aadhaar Act requiring such information from residents for obtaining Aadhaar numbers pass the three-fold test of legality, legitimate state aim, and proportionality as laid down in the landmark privacy judgment.

- Whether the collection, storage, retention, use, sharing, and potential surveillance arising from the Aadhaar scheme violate fundamental rights.

- Whether Section 7 of the Aadhaar Act, making Aadhaar authentication mandatory for receipt of subsidies, benefits, or services funded from the Consolidated Fund of India, is constitutional, particularly in light of the right to food and shelter under Article 21.

- Whether the sharing of identity information under Section 29 is constitutional.

- Whether Section 33 allowing disclosure of Aadhaar information pursuant to court orders or in the interest of national security violates fundamental rights, including protection against self-incrimination under Article 20(3).

- Whether Section 47, which restricts filing of complaints for offences under the Act to the UIDAI or authorized persons, is constitutional.

- Whether Section 57, permitting use of Aadhaar number for any purpose by the State or private entities pursuant to any law or contract, is constitutional.

- Whether Section 59, which seeks to retrospectively validate actions taken under executive notifications prior to the Aadhaar Act, is valid.

- Whether the collection of identity information of children between 5 to 18 years without parental consent is constitutional.

- Whether the Prevention of Money-Laundering (Maintenance of Records) Second Amendment Rules, 2017, mandating Aadhaar linking for bank accounts, are constitutional.

- Whether the Department of Telecommunications' circular dated 23.03.2017 mandating Aadhaar-based e-KYC for mobile subscribers is valid.

- Whether the Aadhaar Act was rightly passed as a Money Bill and whether the Speaker's certification is subject to judicial review.

- Whether Section 139-AA of the Income Tax Act, mandating Aadhaar-PAN linking, is constitutional.

- Whether the Aadhaar Act violates interim orders passed by this Court in related writ petitions.

2. ISSUE-WISE DETAILED ANALYSIS

Issues 1 & 2: Requirement to Provide Demographic and Biometric Information and Constitutionality of Aadhaar Act Provisions

The Court examined the object and purpose of the Aadhaar Act, which aims to provide a unique identity number to residents based on demographic and biometric information, to facilitate efficient and targeted delivery of subsidies, benefits, and services funded from the Consolidated Fund of India.

Demographic information includes name, date of birth, gender, and residential address, excluding sensitive categories like race, religion, caste, income, or medical history. The Court held that providing such demographic information does not violate the right to privacy, as these details are commonly disclosed in various statutory and social contexts and do not attract a reasonable expectation of privacy.

Biometric information includes photographs, fingerprints, and iris scans. The Court recognized that biometric data may invoke a reasonable expectation of privacy but held that the Aadhaar Act's collection of biometric data is justified under the three-fold test laid down in the privacy judgment: (i) existence of law (the Aadhaar Act), (ii) legitimate state aim (targeted delivery of welfare benefits, prevention of fraud, and financial inclusion), and (iii) proportionality (the measures are rationally connected and necessary to achieve the aim without excessive infringement).

The Court rejected arguments that biometric data collection is an impermissible intrusion, noting that fingerprints and iris scans are physical identifiers used globally and do not reveal intimate personal details beyond identity verification.

Issues 3, 4 & 5: Collection, Storage, Retention, Use, Sharing, and Surveillance

The Court analyzed the statutory regime governing the collection, storage, and use of Aadhaar data, including detailed provisions on data security, confidentiality, and restrictions on sharing core biometric information.

It held that the Aadhaar Act and its regulations provide adequate safeguards to protect data and privacy, including limitations on data retention periods and restrictions on sharing identity information without consent.

Regarding surveillance concerns, the Court found that the architecture does not facilitate pervasive or real-time mass surveillance by the State. Metadata stored is limited to technical details of authentication transactions without storing the purpose of authentication, and the system is designed with multiple security measures including encryption and physical safeguards.

While acknowledging some apprehensions about data security, the Court observed that these do not justify invalidating the Act, particularly given ongoing efforts to enact comprehensive data protection legislation.

Issues 6 & 7: Constitutionality of Section 7 and Balancing Right to Food, Shelter, etc., with Right to Privacy

Section 7 mandates Aadhaar authentication or proof of Aadhaar number as a condition for receipt of subsidies, benefits, or services funded from the Consolidated Fund of India.

The Court recognized the legitimate state interest in ensuring that welfare benefits reach intended beneficiaries and in preventing leakages due to fake or duplicate identities, referencing reports of significant diversion of subsidies prior to Aadhaar.

It held Section 7 constitutional, noting that failure of authentication does not preclude alternate means of identification, and that the State has a duty to remedy exclusionary effects.

The Court emphasized that the right to food, shelter, and other socio-economic rights under Article 21 cannot be made subordinate to the right to privacy; rather, a balance must be struck to protect both rights harmoniously.

While recognizing the probabilistic nature of biometric authentication and potential for errors, the Court found that the statutory framework and administrative measures mitigate exclusion risks, and that the provision does not violate fundamental rights.

Issue 8: Constitutionality of Section 29 (Restriction on Sharing Information)

Section 29 prohibits sharing of core biometric information and restricts use and disclosure of identity information without consent, except as permitted by the Act and regulations.

The Court held that Section 29 is a regulatory provision designed to protect privacy and does not violate fundamental rights. It ensures that sharing is controlled, consensual, and limited to legitimate purposes, including national security under strict conditions.

Issue 9: Constitutionality of Section 33 (Disclosure of Information in Certain Cases)

Section 33 permits disclosure of identity information pursuant to court orders (not inferior to District Judge) or in the interest of national security upon direction by a senior government officer, subject to oversight and time limits.

The Court held Section 33 constitutional, noting safeguards such as requirement of judicial order and oversight committee. It rejected claims that disclosure violates protection against self-incrimination under Article 20(3), distinguishing between testimonial compulsion and provision of biometric or demographic data for identification.

Issue 10: Constitutionality of Section 47 (Cognizance of Offence)

Section 47 restricts courts from taking cognizance of offences under the Act except on complaint by the UIDAI or authorized persons.

The Court upheld Section 47 as constitutional, observing that similar provisions exist in other statutes to prevent frivolous complaints and to ensure effective enforcement by the designated authority. Victims can approach UIDAI or use other legal remedies under the Information Technology Act or IPC for data breaches or identity theft.

Issue 11: Constitutionality of Section 57 (Use of Aadhaar Number for Other Purposes)

Section 57 allows use of Aadhaar number for any purpose by State or private entities pursuant to any law or contract, subject to the Act's procedures and obligations.

The Court struck down the phrase "or any contract to this effect" as unconstitutional and void, holding that use of Aadhaar based solely on contract lacks legislative backing and safeguards, risking commercial exploitation and profiling without consent.

The remainder of Section 57, allowing use pursuant to valid law, was upheld subject to the three-fold test of legality, legitimate aim, and proportionality.

Issue 12: Validity of Section 59 (Validation of Actions Prior to Aadhaar Act)

Section 59 seeks to retrospectively validate actions taken under executive notifications of 2009 and 2015 as if done under the Aadhaar Act.

The Court upheld Section 59 as a valid legislative device creating a legal fiction to protect actions taken by the Central Government under the notifications, treating them as done under the Act.

However, it noted that the 2009 notification did not authorize collection of biometric data, and that informed consent and data protection safeguards introduced by the Aadhaar Act were absent prior to 2016. Section 59 cannot cure these fundamental deficiencies or retroactively validate collection of biometric data without proper legal framework.

Issue 13: Collection of Identity Information of Children Between 5 to 18 Years

The Court held that for children between 5 and 18 years, parental or guardian consent must be read into the regulations for enrolment to uphold constitutionality, as minors cannot provide valid consent themselves.

Issue 14: Constitutionality of Prevention of Money-Laundering (Maintenance of Records) Second Amendment Rules, 2017

The Rules mandate submission and authentication of Aadhaar numbers for opening and operating bank accounts.

The Court upheld the Rules as constitutional, recognizing the legitimate state aim of preventing money laundering, black money, and financial frauds.

It rejected arguments of arbitrariness and violation of fundamental rights, noting that the Rules provide for phased compliance, allow for small accounts with relaxed norms, and do not deprive account holders of property but only temporarily restrict operation until compliance.

The Court held the Rules are not ultra vires the parent Act and conform to the proportionality test.

Issue 15: Validity of Circular Dated 23.03.2017 by Department of Telecommunications

The circular directed all telecom licensees to re-verify all existing mobile subscribers through Aadhaar-based e-KYC.

The Court held the circular is not a 'law' under Article 13(3) and lacks statutory backing, thus is unconstitutional.

It noted that the Court's order in the related writ petition did not direct such mandatory verification but only recorded the government's undertaking.

The Court directed deletion of biometric and Aadhaar data collected by telecom service providers and prohibited their use.

Issue 16: Whether Aadhaar Act is a Money Bill and Judicial Review of Speaker's Certification

The Court held that the Speaker's certification of the Aadhaar Bill as a Money Bill is not immune from judicial review.

It analyzed Article 110 and held that a Money Bill must contain only provisions dealing with matters listed in clauses (a) to (f). The Court found that while Section 7 of the Act relates to expenditure from the Consolidated Fund, other provisions fall outside the scope of a Money Bill.

Therefore, the Aadhaar Bill did not qualify as a Money Bill and the Speaker's decision was subject to judicial review.

However, the Court upheld the certification as valid in this case, holding the Act was properly passed as a Money Bill.

Issue 17: Constitutionality of Section 139-AA of Income Tax Act

Section 139-AA mandates quoting Aadhaar number for PAN application and income tax returns.

The Court upheld its constitutionality subject to the three-fold test from the privacy judgment: existence of law, legitimate state interest, and proportionality.

The legitimate aims include curbing black money, tax evasion, and money laundering.

The Court rejected claims of discrimination or violation of privacy, noting the provision targets individuals and is a reasonable step to weed out fake PANs.

Issue 18: Whether Aadhaar Act Violates Interim Orders of the Court

The Court held that the Aadhaar Act does not violate the interim orders passed in the writ petitions, as those orders were issued when Aadhaar was an executive scheme without legislative backing.

The Act provides statutory framework and safeguards, and the interim orders do not preclude the government from legislating on the matter.

3. SIGNIFICANT HOLDINGS

- "The requirement under Aadhaar Act to give one's demographic and biometric information does not violate fundamental right of privacy."

- "The provisions of Aadhaar Act requiring demographic and biometric information from a resident for Aadhaar Number pass three-fold test as laid down in Puttaswamy case."

- "Collection of data, its storage and use does not violate fundamental Right of Privacy."

- "Aadhaar Act does not create an architecture for pervasive surveillance."

- "Section 7 of the Aadhaar is constitutional. The provision does not deserve to be struck down on account of denial in some cases of right to claim on account of failure of authentication."

- "The State while enlivening right to food, right to shelter etc. envisaged Under Article 21 cannot encroach upon the right of privacy of beneficiaries nor former can be given precedence over the latter."

- "Section 29 is constitutional and does not deserve to be struck down."

- "Section 33 is constitutional and does not violate protection under Article 20(3)."

- "Section 47 is constitutional; it does not violate the right of an individual to initiate criminal proceedings."

- "Section 57, to the extent permitting use of Aadhaar by private entities pursuant to any contract, is unconstitutional and void."

- "Section 59 validly retrospectively validates actions taken by Central Government under notifications of 2009 and 2015, but does not cure absence of legal framework or safeguards prior to 2016."

- "Parental consent must be read into regulations for enrolment of children between 5 to 18 years."

- "Prevention of Money-Laundering (Maintenance of Records) Second Amendment Rules, 2017 are constitutional."

- "Circular dated 23.03.2017 by Department of Telecommunications is unconstitutional and set aside."

- "Aadhaar Act was rightly passed as a Money Bill; however, the Speaker's certification is subject to judicial review."

- "Section 139-AA of Income Tax Act does not breach the fundamental right to privacy."

- "Aadhaar Act does not violate interim orders of this Court."

- "Order directing disclosure of Aadhaar data by Judicial Magistrate First Class was invalid under Section 33 of the Aadhaar Act."p>